Tag
In 2024, the sidecar-or-not debate has an answer: Istio Ambient Mesh and Cilium Service Mesh bring sidecarless architecture to production, while Linkerd keeps ultra-light Rust sidecars. The right choice depends on your current CNI, the features you need, and the size of your ops team, not on which project wins in the abstract.
Cilium Service Mesh replaces Istio or Linkerd sidecars with eBPF in the kernel: it handles policy, WireGuard encryption, and Hubble observability without a per-pod proxy, cutting memory overhead from roughly 100 GB to about 5 GB in a 100-node cluster. It suits large clusters with teams comfortable with eBPF.
Linkerd is the pragmatic service mesh for Kubernetes, prioritizing simplicity over feature catalogues. Its Rust proxy uses ~10 MB RAM per sidecar versus 50-100 MB for Envoy under Istio. This comparison explains when adopting it pays off, what it costs to operate, and when Istio makes more sense.
A service mesh adds mTLS, uniform observability, and traffic management between microservices without modifying application code. The ecosystem has consolidated: Istio is the most complete and complex, Linkerd prioritises simplicity with Rust proxies, and Cilium delivers sidecarless service mesh via eBPF.
Cilium replaces iptables with eBPF programs loaded directly into the Linux kernel, substituting O(n) linear chains with O(1) hash lookups. Documented benchmarks show up to 50% lower p95 latency, 2-3x more throughput, and 70% less kernel CPU in large Kubernetes clusters.
Kubernetes 1.28 introduces native sidecar containers in alpha via KEP-753: adding restartPolicy Always to initContainers ensures correct startup and shutdown ordering. It fixes Jobs that never terminate. Istio, Linkerd, and observability agents like Fluent Bit are the primary beneficiaries.
